Lecture 238: Gateway Load Balancer - Exam Essentails
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:00
- 来源：Udemy Lecture 29240556
- Slide 数量：4
- 画面切换：00:48、02:01、03:06
扫描说明
逐条读取了 Transcript 面板中的 95 条英文 cue，并按播放器进度同步全长约 04:00 的视频。依据 Listener、Targets/GENEVE/Stickiness、Internal/Network Limits、Service Selection 划分为 4 个小节。4 张截图来自 Exam Essentials Slide 在对应讲解阶段的实际画面，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. GWLB Listener 接收所有 IP Packet/Port，只有固定 Forward Rule
时间范围：00:00–00:48
总结 / Summary
中文
GWLB 创建时自带一个 Listener，它接收跨所有 Port 的 IP Packet，不能像 ALB/NLB 那样选择 Listener Protocol 或 Port。Listener 只提供把请求转发到 Target Group 的 Rule，不支持 ALB 的 Host-based 或 Path-based Routing；该 Listener 也不能删除。考试遇到需要基于 URL/Host 分流的场景，应想到 ALB，而不是 GWLB。
English
A GWLB is created with a listener that receives IP packets across all ports. Unlike an ALB or NLB listener, its protocol and port are not selectable. The listener has a fixed forwarding rule to a target group and does not provide ALB-style host- or path-based routing; it also cannot be deleted. Exam scenarios requiring URL or host routing therefore point to an ALB rather than a GWLB.
Transcript
00:00 Okay, so now let's look at some important points
00:03 with respect to the exam for Gateway Load Balancer.
00:06 So as you know,
00:07 Gateway Load Balancer has a listener
00:09 and it listens for all traffic and all ports.
00:13 That means you can't really change that
00:16 unlike ALB or Network Load Balancer,
00:19 you could configure your listener
00:21 and configure the port
00:22 on which the load balancer will listen,
00:24 but in case of Gateway Load Balancer,
00:26 it listens for all packet across all ports
00:29 and you can't even specify the protocol or port there.
00:32 And you can only specify the rule
00:34 for routing the request to the target group,
00:36 that means there are URL best routing
00:38 or host based routing like in ALB
00:41 and finally, the listener cannot be deleted.
00:44 That means it comes along with your Gateway Load Balancer.
2. Target 可用 Instance/IP，GENEVE 6081、Flow Stickiness 与 Health Check 是高频考点
时间范围：00:48–02:01
总结 / Summary
中文
Target Group 可注册 EC2 Instance（也可由 Auto Scaling Group 管理）或 Private IP。GWLB 与 Target 之间固定使用 GENEVE over UDP 6081，因此 Appliance 与其 Security Controls 必须支持这条 Data Path。TCP/UDP Flow 用 5-tuple（Source IP/Port、Destination IP/Port、Protocol）保持到同一 Appliance 的 Stickiness；其他 Protocol 使用 Source IP、Destination IP、Protocol 的 3-tuple。Health Check 支持 HTTP、HTTPS 或 TCP，本课程 Lab 按 Check Point 要求使用 TCP 443。
English
A target group can register EC2 instances, including those managed by an Auto Scaling group, or private IP addresses. GWLB-to-target traffic uses GENEVE over UDP 6081, so the appliance and its security controls must support that data path. TCP and UDP flows use the five-tuple—source address and port, destination address and port, and protocol—for stickiness to one appliance; other protocols use the three-tuple of source address, destination address, and protocol. Health checks can use HTTP, HTTPS, or TCP; the course lab used TCP 443 for Check Point.
Transcript
00:48 Further you have the target groups
00:50 like other load balancers
00:52 and this target groups could have targets as EC2 instances,
00:56 which can be managed by auto scaling group
00:59 or this could be applied with IP addresses.
01:02 Now the traffic between Gateway Load Balancer
01:04 and its targets are exchanged using the GENEVE protocol
01:08 that you know
01:09 and this happens over UDP port 6081.
01:12 And that means the network appliance
01:14 must support the UDP traffic
01:17 on port 6081.
01:20 Now Gateway Load Balancer
01:21 also maintains the stickiness of flow
01:23 to a specific target appliance using 5-tuple
01:27 for TCP and UDP flow.
01:29 5-tuple means the source IP address,
01:32 the source port, destination IP address, destination port,
01:36 and the protocol.
01:37 But if it is not a TCP or UDP flows,
01:40 then it only does the stickiness using 3-tuple,
01:43 that means source IP, destination IP, and the protocol.
01:47 And you know that it also supports the health check.
01:51 And for health check,
01:52 you can have HTTP or HTTPS or TCP traffic.
01:56 Now, in case of our exercise, we had used TCP port 443.
3. GWLB 是 Internal-only，靠 Endpoint Service/GWLBE 消费，限制落在 Target 与 MTU
时间范围：02:01–03:06
总结 / Summary
中文
按本讲给出的考试口径，GWLB 是 Internal-only，没有 Public DNS，Consumer 必须通过 Gateway Load Balancer Endpoint Service 与 GWLBE 访问；本讲还强调不支持 Dual-stack、只处理 IPv4。GWLB 自身不关联 Security Group，因此 Appliance Target 的 Security Group/NACL 必须允许来自 GWLB Data Plane 的 GENEVE UDP 6081 与 Health Check。支持的 MTU 为 8500 Bytes；设计时仍要考虑 Encapsulation Overhead 与 End-to-End Path MTU，避免 Fragmentation 或 Drop。
English
Under the exam guidance presented in this lecture, a GWLB is internal-only with no public DNS, so consumers reach it through a Gateway Load Balancer endpoint service and GWLBE. The lecture also states that dual stack is unsupported and traffic is IPv4-only. A GWLB itself has no associated security group, so appliance-target security groups and NACLs must allow GENEVE UDP 6081 and health checks from the GWLB data plane. It supports an 8,500-byte MTU, but designs must still account for encapsulation overhead and end-to-end path MTU to avoid fragmentation or drops.
Transcript
02:01 Moving on the Gateway Load Balancer
02:04 doesn't support the public load balancer.
02:07 That means they are internal only
02:09 and there is no public DNS (indistinct).
02:11 And that's why you can't really reach
02:13 to the Gateway Load Balancer directly,
02:15 instead you have to first create
02:16 the Gateway Load Balancer endpoint service,
02:18 and then you have to create endpoint
02:20 to send the traffic to the Gateway Load Balancer.
02:24 It doesn't also support the dual stack mode,
02:27 as of now, it is only supported for IPv4 traffic only.
02:31 And there is no security group as you'll see
02:34 while creating the Gateway Load Balancer
02:36 we never set up the security group.
02:38 So there are no security groups
02:40 and ultimately that means the target
02:43 which are the receiving the traffic
02:45 should have the security groups
02:46 which allows the traffic to come
02:49 from the Gateway Load Balancer itself.
02:52 If you talk about the MTU,
02:54 the Gateway Load Balancer supports the MTU of 8500 byte,
02:59 and which means that you can send larger packet
03:02 through this Gateway Load Balancer
03:04 thereby improving the network performance.
4. 题目选型：GWLB 插入 Third-party Appliance，Network Firewall 是 AWS-managed Firewall
时间范围：03:06–04:00
总结 / Summary
中文
GWLB 与 ALB/NLB 的核心区别不是一般 Application/Transport Load Balancing，而是把 Traffic 透明送给 Network Appliance。若题目要求继续使用 Palo Alto、Fortinet、Check Point 等第三方 Firewall/Inspection Appliance，并需要集中化、弹性和对称转发，应选 GWLB。若需求是 AWS 原生、Fully Managed Firewall Engine 与 Managed Rule Groups，则应选 AWS Network Firewall。先识别“谁执行安全策略”，再判断所需的 Insertion 与 Routing Service。
English
The defining difference from ALB or NLB is that GWLB transparently sends traffic to network appliances rather than providing ordinary application or transport load balancing. A scenario that retains third-party firewalls or inspection appliances such as Palo Alto, Fortinet, or Check Point while requiring centralized, elastic, symmetric insertion points to GWLB. A requirement for an AWS-native fully managed firewall engine and managed rule groups points to AWS Network Firewall. First identify which component executes policy, then choose the insertion and routing service.
Transcript
03:06 So that's it about the Gateway Load Balancer
03:09 that you need to know.
03:11 Now, just one more thing I want to add here is that
03:13 we have seen a lot of services.
03:15 Now, Gateway Load Balancer is different to ALB or NLB.
03:19 It is specifically used to send the traffic
03:22 to a network appliances.
03:24 Now you might also ask,
03:26 we also have AWS Network Firewall
03:28 then what's the use of it?
03:29 Now understand that Network Firewall
03:31 is a fully managed firewall by AWS,
03:34 but in case of Gateway Load Balancer,
03:36 you are using third-party network firewalls or appliances.
03:39 So that's the difference between these two
03:42 that you need to remember.
03:43 So according to the scenario,
03:45 you should be able to choose
03:46 whether it's a Gateway Load Balancer you will be using
03:49 or the AWS Network Firewall you will be using
03:52 or other load balancer that you will be using.
03:54 So I hope that is clear.
03:56 And with that, let's wrap this session.
03:59 Thank you.
整讲总结 / Overall Summary
中文
GWLB 考点集中在不可配置/删除的全流量 Listener、Instance/IP Target、GENEVE UDP 6081、TCP/UDP 5-tuple 与其他协议 3-tuple Stickiness、HTTP/HTTPS/TCP Health Check，以及 Internal-only Endpoint Service/GWLBE 模型。选型时，GWLB 用于透明插入 Third-party Appliance；AWS Network Firewall 则提供 AWS Fully Managed Firewall。
English
GWLB exam points center on its nonconfigurable all-packet listener, instance or IP targets, GENEVE UDP 6081, five-tuple stickiness for TCP or UDP and three-tuple stickiness for other protocols, HTTP or HTTPS or TCP health checks, and its internal endpoint-service and GWLBE consumption model. GWLB transparently inserts third-party appliances, whereas AWS Network Firewall supplies an AWS-managed firewall.
返回顶部 ↑